Motivated by the local model poisoning attacks in Byzantine-robust FL classification models proposed in [1]}, we depict the framework of FedGAN using a commonly FL training strategy that averages the shared model parameters, FedAvg [2]}, in Fig. REF . As introduced in Section REF  that studies have extensively explored gradient inversion attacks and inference attacks to infer or reconstruct the inputs of FL models given the shared model parameters, exposing FL training in privacy risk. In light of this, we keep the discriminators (binary classification neural networks) in GAN updating locally as they have direct access to clients' private data, making them vulnerable to data leakages if their gradients are inverted or inference attacks are used in FL training [3]}. Our FedGAN framework only exchanges generator's parameters with the server and uses FedAvg to update the global generator. To this end, our FedGAN locally trains both discriminator and generator pairs and globally shares generators' parameters, which is motivated from [4]}.
